North Korean APT Kimsuky Uses forceCopy Malware to Steal Browser-Stored Credentials

The North Korea-linked nation-state hacking group known as Kimsuky has been observed conducting spear-phishing attacks to deliver an information stealer malware named forceCopy, according to new findings from the AhnLab Security Intelligence Center ASEC. The attacks commence with phishing emails...

Silent Lynx Using PowerShell, Golang, and C++ Loaders in Multi-Stage Cyberattacks

A previously undocumented threat actor known as Silent Lynx has been linked to cyber attacks targeting various entities in Kyrgyzstan and Turkmenistan. "This threat group has previously targeted entities around Eastern Europe and Central Asian government think tanks involved in economic decision...

CVE-2024-23464

In certain cases, Zscaler Internet Access ZIA can be disabled by PowerShell commands with admin rights. This affects Zscaler Client Connector on Windows 4.2.1...

Coyote Malware Expands Reach: Now Targets 1,030 Sites and 73 Financial Institutions

Brazilian Windows users are the target of a campaign that delivers a banking malware known as Coyote. "Once deployed, the Coyote Banking Trojan can carry out various malicious activities, including keylogging, capturing screenshots, and displaying phishing overlays to steal sensitive credentials,...

MintsLoader Delivers StealC Malware and BOINC in Targeted Cyber Attacks

Threat hunters have detailed an ongoing campaign that leverages a malware loader called MintsLoader to distribute secondary payloads such as the StealC information stealer and a legitimate open-source network computing platform called BOINC. "MintsLoader is a PowerShell based malware loader that...

Backup or Backup Copy Job for SharePoint, OneDrive, or Teams Data Fails With: "Cannot find object"

Challenge After upgrading Veeam Backup for Microsoft 365 to v8 builds 8.0.2.159 or 8.0.2.200, an incremental backup or a backup copy job protecting SharePoint, OneDrive, or Teams data fails with the error: Cannot find object ... Cause In Object Storage Repositories, the metadata saved for the...

Imperva Protects Against the Exploited CVEs in the Cleo Data Theft Attacks

The Clop ransomware group has once again demonstrated its ability to exploit vulnerabilities to compromise sensitive systems. As Cleo—a managed file transfer provider for businesses—grapples with the aftermath of Clop’s targeted attack on their systems, the spotlight turns to CVE-2024-50623 and...

MAL-2025-616 Malicious code in marked-at (npm)

This package contains a PowerShell download cradle to execute a Cobalt Strike beacon and establish command and control. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2adf9556402c124dc6a1146e6c3bb6a90efee66a9a0bbfdeb3188d4477099d2d Any computer that has this packag...

Malicious code in marked-at (npm)

This package contains a PowerShell download cradle to execute a Cobalt Strike beacon and establish command and control. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2adf9556402c124dc6a1146e6c3bb6a90efee66a9a0bbfdeb3188d4477099d2d Any computer that has this packag...

MAL-2025-617 Malicious code in outlookapi (npm)

The package contains several malicious PowerShell and VBS scripts used to harvest browser data, take screenshots, log keystrokes, and establish startup persistence. It also bundles a password stealer and exfiltrates stolen data via Slack and Discord webhooks. --- -= Per source details. Do not edi...

Hackers Hide Malware in Images to Deploy VIP Keylogger and 0bj3ctivity Stealer

Threat actors have been observed concealing malicious code in images to deliver malware such as VIP Keylogger and 0bj3ctivity Stealer as part of separate campaigns. "In both campaigns, attackers hid malicious code in images they uploaded to archive.org, a file-hosting website, and used the same...

Malicious code in walletcore-gen (npm)

The package contains several malicious PowerShell and VBS scripts used to harvest browser data, take screenshots, log keystrokes, and establish startup persistence. It also bundles a password stealer and exfiltrates stolen data via Slack and Discord webhooks. --- -= Per source details. Do not edi...

MAL-2025-46 Malicious code in solanacore (npm)

The package contains several malicious PowerShell and VBS scripts used to harvest browser data, take screenshots, log keystrokes, and establish startup persistence. It also bundles a password stealer and exfiltrates stolen data via Slack and Discord webhooks. --- -= Per source details. Do not edi...

MAL-2025-45 Malicious code in solana-login (npm)

The package contains several malicious PowerShell and VBS scripts used to harvest browser data, take screenshots, log keystrokes, and establish startup persistence. It also bundles a password stealer and exfiltrates stolen data via Slack and Discord webhooks. --- -= Per source details. Do not edi...

PT-2024-27877 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue concerns automated Windows patching with PowerShell. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability...

Start menu may stop responding if December 2024 or newer security updates installed on Windows 11

Start menu within a Windows 11 VDI session may not respond for some users after installing Microsoft's December 2024 or newer security updates TPV-6122 Solution This issue is fixed in the Citrix Virtual Apps and Desktops 7 2503 and newer versions. If users are using LTSR or older versions of Citr...

⚡ THN Weekly Recap: Top Cybersecurity Threats, Tools and Tips

This past week has been packed with unsettling developments in the world of cybersecurity. From silent but serious attacks on popular business tools to unexpected flaws lurking in everyday devices, there's a lot that might have flown under your radar. Attackers are adapting old tricks, uncovering...

"Windows Script Host must be enabled for the duration of setup process"

Challenge While attempting to Install or Upgrade Veeam Backup & Replication, the installer displays the message: Windows Script Host must be enabled for the duration of setup process, Refer to KB4699 for more information https:// www.veeam.com/kb4699. Cause This message is displayed when the...

Cleo多款产品 安全漏洞

Cleo LexiCom and others are products of Cleo Corporation.Cleo LexiCom is an integration platform.Cleo Harmony is a file integration solution.Cleo VLTrader is a secure hosted file transfer software. A security vulnerability exists in various Cleo products that originates from the ability of an...

CVE-2024-55956

In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory...